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We extend the security proof for continuous variable quantum key distribution protocols using 
post selection to account for arbitrary eavesdropping attacks by employing the concept of an equiv- 
alent protocol where the post-selection is implemented as a projective quantum measurement. We 
demonstrate that the security can be calculated using only experimentally accessible quantities and 
finally explicitly evaluate the performance for the case of a noisy Gaussian channel in the limit of 
unbounded key length. 



Quantum key distribution (QKD) is the process of gen- 
erating a common random key between two parties using 
a quantum communications protocol. The power of this 
method is that the security of the key distribution, and 
the subsequent communication via a one time pad, is es- 
tablished while making no assumptions about the tech- 
nological capabilities of a eavesdropper. This procedure 
also has the distinction of being the most developed [1] 
quantum information technology. 

There are two main flavours of QKD, discrete variable 
(DV) and continuous variable (CV) which are realised by 
encoding and then detecting single photons and the 
quadrature variables Q of the optical field respectively. 
The latter kind, which we shall consider here, has the ad- 
vantage of higher raw bit rates due to the high efficiency 
and high bandwidth of homodyne detection and ease of 
integration with existing communications infrastructure. 
CV protocols that employ post-selection [4J - a classical 
filtering of the measurement results - enjoy additional 
advantages in terms of versatility and reconciliation effi- 
ciency. 

Asymptotic (in the sense of string length) uncondi- 
tional security for protocols that do not employ post- 
selection is achieved by first noting the equivalence of 
an experimentally implemented prepare and measure 
(P&M) scheme to an entanglement based (EB) version 
[5(, followed by the result that for collective attacks se- 
curity may be bounded from below by assuming the en- 
tangled state at the end of the protocol is Gaussian Q 
and finally a proof that that collective attacks are asymp- 
totically optimal 0- However for protocols using post- 
selection (PS) this analysis cannot be straightforwardly 
applied as an equivalent entanglement based picture has 
yet to be constructed, with security only shown under 
the assumption of a Gaussian eavesdropping attack Q. 
By filling in this gap we are able to provide a security 
proof for coherent state post-selection protocols. 

Security of CVQKD. — In general one equates each pro- 



tocol in which: the sender (Alice) prepares an ensemble 
of quantum states based upon a classical random prob- 
ability distribution and sends it through the domain of 
the eavesdropper (Eve) to the recipient (Bob), to an en- 
tanglement based scheme in which: Alice prepares an 
entangled state one half of which is kept and used for 
a projective measurement; and the other is transmitted 
to Bob again through Eves domain. The proper choice 
of the initial entangled state and the projective measure- 
ment by Alice allows us to rigorously express any prepare 
and measure scheme Bob makes a quadrature mea- 
surement upon his received states and then Alice and 
Bob engage in a reconciliation procedure to correct the 
errors in their shared classical string. The secret key rate 
for the entire protocol is then given by 

K = Pl(a : b) - I(E : X), X e {A, B} (1) 

where I (a : b) is the Shannon mutual information be- 
tween classical strings belonging to Alice and Bob at the 
end of the protocol, (3 is the efficiency of their recon- 
ciliation procedure and I{E : X) is the quantum mu- 
tual information between either Eve and Bob if consid- 
ering reverse reconciliation protocols or Eve and Alice if 
considering direct reconciliation. Although employing a 
Gaussian encoding would in principle be optimal for Al- 
ice and Bob, in practice the reconciliation efficiency of 
such a scheme scales poorly with loss. An alternative 
is to use a simpler sign encoding for which the mutual 
information is 

I(A:B) = 1 + Pe \og 2 ( Pe ) + (1 - p e ) log 2 (l - p e ) (2) 

where p e is the probability of Bob measuring a positive 
value given a negative encoding and vice versa. 

Eve's mutual information is given by the difference be- 
tween von Neumann entropies of the entangled state be- 
fore and after Alice or Bob's measurement. The direct 
reconciliation expression is GarciaPatron:2006p381 

I(E : A) = S(E) - S(E\a) = S(AB) - S(B\a) (3) 



2 



with the von Neumann entropy given by S(p) — 
tr(plogp) and for the second equality we have used the 
fact that overall tripartite state \ABE) is pure. This 
quantity is not easy to calculate in general but it has 
been shown Q that we may bound the expression from 
below by analysing a Gaussian state with the same first 
and second moments. For Gaussian states, the von Neu- 
mann entropy is obtained straightforwardly and thus the 
security of the entire protocol can be characterised en- 
tirely by the covariance matrix of the entangled state 
shared by Alice and Bob. 

Equivalent post- selection scheme. — While reverse rec- 
onciliation can be shown to to be secure for large losses 
direct reconciliation is only successful when the channel 
loss is below 50% or 3dB. This can be remedied using 
post-selection [4|], a technique in which a region is iden- 
tified in the space of Bob's possible quadrature measure- 
ment results and Alice's quadrature encoding and only 
instances within the region are kept to form the key. This 
improved performance comes at the price of not being 
able to directly apply Eq(3] as this would not allow for 
Eve's knowledge of Alice and Bob's post-selection. This 
can be accounted for as long as one can keep track of 
the way post-selection by one party influences the state 
of the other in the equivalent EB scheme which we shall 
now demonstrate. 





FIG. 1: Prepare and measure and entanglement based ver- 
sions of a post-selected protocol. In the P&M scheme a), 
Alice sends a ensemble of coherent states through Eve's do- 
main to Bob who heterodyne detects and applies classical 
post-processing. Equivalently, b), Alice and Bob pass their 
respective arms of a distributed EPR pair through devices 
that project into quadrature regions corresponding to data 
kept in a). Security is calculated for an equivalent all Gaus- 
sian scheme, c), that has the same output statistics from het- 
erodyne measurement, providing a lower bound on the secret 
key rate. 



For the sake of concreteness we shall consider a partic- 



ular P&M scheme, Fig.l panel a), in which Alice draws 
values (xa,Pa) from a bivariate Gaussian of mean and 
variance Va and uses these numbers to modulate the 
vacuum to create an ensemble of coherent states of the 
form \x + ip) which she sends to Bob through a quantum 
channel. Bob uses heterodyne detection on his received 
states, measuring quadratures given by x = a + and 
p = i(a^ — a) where we have normalised the vacuum noise 
to unity. Alice then filters her results such that she only 
keeps values whose magnitude lies between upper Ua and 
lower La thresholds, i.e. La < \xa\, \pa\ < Ua and Bob 
similarly post-selects his measurement results such that 
Lb < |#a|,|Pa| < Ub- Finally Alice and Bob publicly 
announce a subset of their data to characterise the chan- 
nel and, if secure, engage in reconciliation and privacy 
amplification to distill a completely secure key. This is 
very similar to the situation that was implemented in 
[t| except for the fact that aside from channel charac- 
terisation, neither Alice or Bob announce anything about 
their measurements or encoding on a shot by shot basis 
and Bob employs heterodyne detection . 

The equivalent entanglement based scheme, Fig.l 
panel b), involves Alice preparing a two-mode squeezed 
vacuum or EPR state, one mode of which she keeps and 
measures, the other is transmitted to Bob over a quantum 
channel. At the measurement step Alice and Bob first 
split up their modes on a balanced beamsplitter intro- 
ducing a unit of vacuum noise. We implement the post- 
selection as a device that non-deterministically performs 
one of the projective measurements f_ u dx\x}(x\ + 

fjj dx \x) (x\ or J_£ dp \p) (p\ + f£ dp \p) (p\. If the mea- 
surement fails the attempt is abandoned. If it succeeds 
the state is retained and subsequently measured. 

Finally we bound the keyrate from below by evaluating 
the security of the third protocol, Fig.l panel c), which 
has exactly the same first and second moments as the pre- 
vious entangled scheme but is entirely Gaussian, allowing 
for the exact calculation of entropies while maximising 
Eve's information. The squeezers are present to reflect 
the fact that Alice's post-selected classical distribution in 
the P&M scheme can have variance less than shot noise, 
thus the corresponding Gaussian protocol must have the 
potential to be squeezed on both arms after the beam- 
splitter. 

Crucially both the variances and the correlations mea- 
sured in the Gaussian EB scheme correspond exactly to 
measurable quantities in the P&M version. Having ob- 
tained these quantities , namely Alice and Bob each mea- 
suring x and p, we wish to infer back through the op- 
erations at their stations to completely characterise the 
two-mode state shared by Alice and Bob directly after 
transmission and hence quantify Eve's information. Bob 
and Alice's operations are just beamsplitters and single 
mode-squeezers so this can be straightforwardly achieved 
at the level of the covariance matrix using appropriate 
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symplectic transformations. Note that Eve's informa- 
tion evaluated with respect to the four mode state just 
prior to measurement will be exactly the same as that 
of the two mode state as the evolution between the two 
points involves only pure states and unitary operations. 
The covariance matrices before and after Alice and Bob's 
beamsplitters are related by, 

7/ = S T (r)BS T (T B ) BS T (T A ) lt BS (T A ) BS (T B ) S(r) 



where 
S(r) = 



e~ r 
e r 



, BS(T) = 



'Tii vt^ti 2 

-VI - Ti 2 VTh 



are the symplectic transformations for a one-mode 
squeezer and a two-mode beamsplitter respectively. Us- 
ing our knowledge of Alice and Bob's station, namely 
that T A = Tb = 5 and that in ji the ancillae are un- 
correlated vacua we can deduce an equivalent 2-mode 
covariance matrix in the standard form of an EPR with 
one arm distributed though a Gaussian channel, 



1AB = 



1 + Uq h 



T)V a + 



f 2V a ) 
rj6 + 1 



h 



(4) 



where the parameters 77, S and V a characterise an effective 
Gaussian ensemble sent though a Gaussian channel. The 
crucial tradeoff in this scheme is between a large post- 
selection to improve the effective channel parameters and 
the probability of obtaining measurement results within 
the post-selection region. Note that in order to safely 
assume that the covariance matrix is of the symmetric 
form, Eq|H Alice and Bob will need to make use of an 
active symmetrisation step as outlined in [111 ]. 

In particular although the post-selection is symmetric 
about the chosen quadratures in phase space it is not gen- 
erally rotationally symmetric. In [ll[ the authors solve 
this issue which similarly effects discretely modulated 
protocols by having Alice and Bob implement a series 
of randomly chosen orthogonal transformations on their 
classical data. This is equivalent to performing random 



conjugate transformations in the EB scheme and allows 
Alice and Bob to essentially enforce the symmetry they 
want. In the P&M version of our protocol these trans- 
formations are performed after measurement but before 
the post-selection. This means that although Eve is as- 
sumed to know the absolute values of the post-selection 
threshold she does not know the direction in phase space 
upon which they will be enforced, preventing her from 
gaining an advantage through symmetry breaking. 

In general the result of the post-selection is to produce 
a much larger initial EPR state that has gone through 
better effective channel. This occurs becuase we are post- 
selecting on the data for which Alice and Bob are more 
correlated. Due to the non-deterministic nature of the 
protocol the information that could be extracted from the 
whole ensemble is sharply decreased but the information 
advantage on the post-selected key is higher. 

Gaussian channel. — Having established a method of 
evaluating security under general eavesdropper attacks 
it remains to see what kind of performance this method 
results in for the most common case, the noisy Gaussian 
channel. Such a channel is completely parameterised by 
it's transmission T and excess thermal noise £. In this 
case there is a class of collective eavesdropper attacks 
known to be equivalent and optimal and we are free to 
choose a specific form to facilitate calculation [12|. We 
choose the entangling doner attack where we assume Eve 
replaces the lossy channel with a perfect channel and a 
beamsplitter of transmission T on which she mixes Al- 
ice's incoming signal with one arm of her own EPR pair. 
Both EPR states are generated by combining finitely x 
and p-squeezed states on balanced beamsplitters. The 
squeezing of Eve's state is determined by the chan- 
nel according to V E = exp (cosh _1 (l — T + £)/(l — T)) 
while the squeezing of Alice's EPR is fixed by the vari- 
ance of her classical distribution according to Vs — 
exp (cosh- 1 (V A + 1)). We now evolve the 6-mode (4 
EPR arms and 2 vacuum ancillae) system through chan- 
nel, beamsplitters and post-selection to obtain that state 
just before the homodyne detectors, 



\ABE) = / d Xl %l>{xi) 



x\ - x 2 x 3 \ 
2 V2/ A 



xi - x 2 _ x 3 \ 
2 V2/a 



— [X-L + X 2 ) [Xi + I 5 ) + 77= 



T 1 — T 

-{x 4 + x 5 ) + Y — ^— Oi +x 2 ) 



X4 x§ 
V2 I r 



^-{ Xl +x 2 ) -y— ( x 4 + 2:5) - , « = 1—6 (5) 



where and the subscripts on the kets indicate ownership. The 

post-selection involves taking definite integrals over Alice 
and Bob's modes and the covariance matrix elements cor- 



^) = ^ eV (6) 
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responding to the measured quadratures are calculated 
according to 7-y = | ({stiXj}) — (xi) (xj) over \ABE). 
Having calculated these quantities we calculate security 
for the symmetric Gaussian state with the same covari- 
ance matrix as outlined above. The final step is to mul- 
tiply this keyrate by the probability of the post-selection 
succeeding, which in the EB scheme is simply the norm 
of the post-selected state. 




Transmission 



FIG. 2: Secret key rates for direct reconciliation combined 
with post-selection as a function of transmission for increas- 
ing levels of excess noise (£ = 0, £ = O.Of, £ = 0.05) with 
decreasing keyrate. 

Results for keyrate as a function of channel transmis- 
sion are given in Fig [2] for realistic levels of thermal noise 
on the channel, where for each pair of channel parameters 
the post-selection is numerically optimised over. Encour- 
agingly we see that noise on the order of 1% results in 
only a modest reduction of the keyrate. 

Conclusions. — 

In conclusion we have shown that post-selection based 
CVQKD is secure for arbitrary collective attacks, and 
thus asymptotically secure for all attacks. This was 
achieved by identifying an entanglement based scheme 
that correctly reflects the post-selected ensemble that is 
used in the final key generation. Furthermore these re- 



sults show little loss of performance compared to previous 
analyses of post-selection and are quite robust to mod- 
est amounts of excess noise on the channel. There are 
several avenues for further work, foremost being the fact 
that the bounds given here are certainly not tight. Other 
topics of interest would be the incorporation of finite-size 
effects and the combination of post-selection with other 
protocols to identify the optimal technique for a given 
scenario. 
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